Skip to content
Critical Vulnerability in Cline Kanban Exposes AI Coding Agents to Hijacking

Critical Vulnerability in Cline Kanban Exposes AI Coding Agents to Hijacking

First seen 7 May 2026, 14:55 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •May 8, 2026 at 14:39 UTC
  • •Cline Kanban server vulnerability allows remote command injection via WebSocket.
  • •Affected version is 0.1.59; patch available in version 0.1.66.
  • •No user interaction required for exploitation, posing a significant risk to developers.

A critical vulnerability (CVSS 9.7) in the Cline Kanban server allows any website a developer visits to silently exfiltrate workspace data and inject commands into the AI agent's terminal. This flaw affects version 0.1.59 of the Kanban npm package and arises from missing origin validation and authentication on WebSocket endpoints. The attack can occur without any user interaction, as malicious JavaScript on any webpage can exploit the vulnerability. This issue affects all developers using Cline's Kanban feature, potentially exposing sensitive data and allowing unauthorized command execution. Oasis Security reported the vulnerability to Cline, which has since released a patch in version 0.1.66. The incident highlights a broader systemic issue with localhost trust boundaries in AI coding platforms.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 161d ago How this analysis works

Timeline

2026-05-07
Vulnerability disclosed
Oasis Security published findings on a critical flaw in Cline Kanban affecting version 0.1.59, allowing unauthorized access.
Infosecurity-Magazine
2026-05-07
Patch released
Cline released version 0.1.66 to address the critical vulnerability identified by Oasis Security.
Oasis Security

More articles in this cluster (5)

Following this threat?

Track Bugcrowd in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4